Iptables anti-DDoS attacks and CC attack settings

Source: Internet
Author: User



Protect against DDoS attack scripts



#防止SYN攻击 Lightweight prevention


iptables -N syn-flood 
iptables -A INPUT -p tcp --syn -j syn-flood 
iptables -I syn-flood -p tcp -m limit --limit 3/s --limit-burst 6 -j RETURN 
iptables -A syn-flood -j REJECT


#防止DOS太多连接进来, you can allow up to 15 initial connections per IP for an external network card, over the discarded


iptables -A INPUT -i eth0 -p tcp --syn -m connlimit --connlimit-above 15 -j DROP 
iptables -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT


#用iptables against DDOS (parameters are the same as above)


iptables -A INPUT  -p tcp --syn -m limit --limit 12/s --limit-burst 24 -j ACCEPT
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT


##########################################################



Protect against CC attacks



When the Apache site is subjected to a severe cc attack, we can use Iptables to prevent the Web server from being attacked by CC, enabling the automatic blocking of IP capabilities.



1. System Requirements



(1) LINUX kernel version: 2.6.9-42ELSMP or 2.6.9-55ELSMP (other kernel versions need to recompile the kernel, which is cumbersome, but can also be implemented).



(2) iptables version: 1.3.7



2. Installation



Install kernel modules for iptables1.3.7 and system kernel versions Kernel-smp-modules-connlimit



3. Configure the appropriate iptables rules



Examples are as follows:



(1) Maximum number of concurrent connections that control a single IP


Iptables-i input-p TCP--dport 80-m connlimit --connlimit-above 50-j REJECT
#Maximum number of connections allowed for a single IP is 30


#默认iptables模块不包含connlimit, you need to compile your own load separately, please refer to this address
http://sookk8.blog.51cto.com/455855/280372 do not compile kernel load connlimit module




(2) control the number of newly established connections in a single IP at a certain time (for example, 60 seconds)

iptables -A INPUT -p tcp --dport 80 -m recent --name BAD_HTTP_ACCESS --update --seconds 60 --hitcount 30 -j REJECT 

iptables -A INPUT -p tcp --dport 80 -m recent --name BAD_HTTP_ACCESS --set -j ACCEPT





#A single IP only allows up to 30 new connections in 60 seconds






4. Verification



(1) Tool: flood_connect.c (used to simulate attack)



(2) View results:



Use
Watch ' Netstat-an | grep:21 | grep< impersonation Attack client's ip>| Wc-l '




Real-time view of the number of connections built up by simulated attack clients,



Use
Watch ' Iptables-l-n-v | \grep< impersonation Attack client's ip> '




View the number of packets that were killed by the simulated attack client.



5. Attention



To enhance iptables's ability to prevent CC attacks, it is best to adjust the ipt_recent parameters as follows:



#cat/etc/modprobe.conf options Ipt_recent ip_list_tot=1000 ip_pkt_list_tot=60
#Record 1000 IP addresses, each address records 60 packets #modprobe Ipt_recent



Iptables anti-DDoS attacks and CC attack settings


Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.